1/*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2019 Yandex LLC 5 * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org> 6 * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com> 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30#include <sys/param.h> 31#include <sys/systm.h> 32#include <sys/counter.h> 33#include <sys/kernel.h> 34#include <sys/lock.h> 35#include <sys/mbuf.h> 36#include <sys/module.h> 37#include <sys/rmlock.h> 38#include <sys/rwlock.h> 39#include <sys/socket.h> 40#include <sys/sysctl.h> 41 42#include <net/if.h> 43#include <net/if_var.h> 44#include <net/if_pflog.h> 45#include <net/pfil.h> 46 47#include <netinet/in.h> 48#include <netinet/ip.h> 49#include <netinet/ip_icmp.h> 50#include <netinet/ip_var.h> 51#include <netinet/ip_fw.h> 52#include <netinet/ip6.h> 53#include <netinet/icmp6.h> 54#include <netinet6/ip_fw_nat64.h> 55 56#include <netpfil/ipfw/ip_fw_private.h> 57#include <netpfil/pf/pf.h> 58 59#include "nat64clat.h" 60 61#define NAT64_LOOKUP(chain, cmd) \ 62 (struct nat64clat_cfg *)SRV_OBJECT((chain), (cmd)->arg1) 63 64static void 65nat64clat_log(struct pfloghdr *plog, struct mbuf *m, sa_family_t family, 66 uint32_t kidx) 67{ 68 static uint32_t pktid = 0; 69 70 memset(plog, 0, sizeof(*plog)); 71 plog->length = PFLOG_HDRLEN; 72 plog->af = family; 73 plog->action = PF_NAT; 74 plog->dir = PF_IN; 75 plog->rulenr = htonl(kidx); 76 pktid++; 77 plog->subrulenr = htonl(pktid); 78 plog->ruleset[0] = '\0'; 79 strlcpy(plog->ifname, "NAT64CLAT", sizeof(plog->ifname)); 80 ipfw_bpf_mtap2(plog, PFLOG_HDRLEN, m); 81} 82 83static int 84nat64clat_handle_ip4(struct ip_fw_chain *chain, struct nat64clat_cfg *cfg, 85 struct mbuf *m) 86{ 87 struct pfloghdr loghdr, *logdata; 88 struct in6_addr saddr, daddr; 89 struct ip *ip; 90 91 ip = mtod(m, struct ip*); 92 /* source address for CLAT may be private with no harm */ 93 if (nat64_check_ip4(ip->ip_src.s_addr) != 0 || 94 nat64_check_ip4(ip->ip_dst.s_addr) != 0 || 95 nat64_check_private_ip4(&cfg->base, ip->ip_dst.s_addr) != 0) 96 return (NAT64SKIP); 97 98 memcpy(&saddr, &cfg->base.clat_prefix, sizeof(saddr)); 99 nat64_embed_ip4(&saddr, cfg->base.clat_plen, ip->ip_src.s_addr); 100 memcpy(&daddr, &cfg->base.plat_prefix, sizeof(daddr)); 101 nat64_embed_ip4(&daddr, cfg->base.plat_plen, ip->ip_dst.s_addr); 102 if (cfg->base.flags & NAT64_LOG) { 103 logdata = &loghdr; 104 nat64clat_log(logdata, m, AF_INET, cfg->no.kidx); 105 } else 106 logdata = NULL; 107 return (nat64_do_handle_ip4(m, &saddr, &daddr, 0, &cfg->base, 108 logdata)); 109} 110 111static int 112nat64clat_handle_ip6(struct ip_fw_chain *chain, struct nat64clat_cfg *cfg, 113 struct mbuf *m) 114{ 115 struct pfloghdr loghdr, *logdata; 116 struct ip6_hdr *ip6; 117 uint32_t aaddr; 118 119 /* 120 * NOTE: we expect ipfw_chk() did m_pullup() up to upper level 121 * protocol's headers. Also we skip some checks, that ip6_input(), 122 * ip6_forward(), ip6_fastfwd() and ipfw_chk() already did. 123 */ 124 ip6 = mtod(m, struct ip6_hdr *); 125 /* Check ip6_dst matches configured prefix */ 126 if (memcmp(&ip6->ip6_dst, &cfg->base.clat_prefix, 127 cfg->base.clat_plen / 8) != 0) 128 return (NAT64SKIP); 129 /* Check ip6_src matches configured prefix */ 130 if (memcmp(&ip6->ip6_src, &cfg->base.plat_prefix, 131 cfg->base.plat_plen / 8) != 0) 132 return (NAT64SKIP); 133 134 if (cfg->base.flags & NAT64_LOG) { 135 logdata = &loghdr; 136 nat64clat_log(logdata, m, AF_INET6, cfg->no.kidx); 137 } else 138 logdata = NULL; 139 140 aaddr = nat64_extract_ip4(&ip6->ip6_src, cfg->base.plat_plen); 141 return (nat64_do_handle_ip6(m, aaddr, 0, &cfg->base, logdata)); 142} 143 144static int 145nat64clat_handle_icmp6(struct ip_fw_chain *chain, struct nat64clat_cfg *cfg, 146 struct mbuf *m) 147{ 148 struct pfloghdr loghdr, *logdata; 149 struct nat64_counters *stats; 150 struct ip6_hdr *ip6i; 151 struct icmp6_hdr *icmp6; 152 uint32_t daddr; 153 int hlen, proto; 154 155 hlen = 0; 156 stats = &cfg->base.stats; 157 proto = nat64_getlasthdr(m, &hlen); 158 if (proto != IPPROTO_ICMPV6) { 159 NAT64STAT_INC(stats, dropped); 160 return (NAT64MFREE); 161 } 162 icmp6 = mtodo(m, hlen); 163 switch (icmp6->icmp6_type) { 164 case ICMP6_DST_UNREACH: 165 case ICMP6_PACKET_TOO_BIG: 166 case ICMP6_TIME_EXCEED_TRANSIT: 167 case ICMP6_PARAM_PROB: 168 break; 169 default: 170 NAT64STAT_INC(stats, dropped); 171 return (NAT64MFREE); 172 } 173 hlen += sizeof(struct icmp6_hdr); 174 if (m->m_pkthdr.len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) { 175 NAT64STAT_INC(stats, dropped); 176 return (NAT64MFREE); 177 } 178 if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) 179 m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN); 180 if (m == NULL) { 181 NAT64STAT_INC(stats, nomem); 182 return (NAT64RETURN); 183 } 184 /* 185 * Use destination address from inner IPv6 header to determine 186 * IPv4 mapped address. 187 */ 188 ip6i = mtodo(m, hlen); 189 daddr = nat64_extract_ip4(&ip6i->ip6_dst, cfg->base.clat_plen); 190 if (daddr == 0) { 191 NAT64STAT_INC(stats, dropped); 192 return (NAT64MFREE); 193 } 194 if (cfg->base.flags & NAT64_LOG) { 195 logdata = &loghdr; 196 nat64clat_log(logdata, m, AF_INET6, cfg->no.kidx); 197 } else 198 logdata = NULL; 199 return (nat64_handle_icmp6(m, 0, daddr, 0, &cfg->base, logdata)); 200} 201 202int 203ipfw_nat64clat(struct ip_fw_chain *chain, struct ip_fw_args *args, 204 ipfw_insn *cmd, int *done) 205{ 206 ipfw_insn *icmd; 207 struct nat64clat_cfg *cfg; 208 int ret; 209 210 IPFW_RLOCK_ASSERT(chain); 211 212 *done = 0; /* try next rule if not matched */ 213 icmd = cmd + 1; 214 if (cmd->opcode != O_EXTERNAL_ACTION || 215 cmd->arg1 != V_nat64clat_eid || 216 icmd->opcode != O_EXTERNAL_INSTANCE || 217 (cfg = NAT64_LOOKUP(chain, icmd)) == NULL) 218 return (0); 219 220 switch (args->f_id.addr_type) { 221 case 4: 222 ret = nat64clat_handle_ip4(chain, cfg, args->m); 223 break; 224 case 6: 225 ret = nat64clat_handle_ip6(chain, cfg, args->m); 226 break; 227 default: 228 return (0); 229 } 230 231 if (ret == NAT64SKIP) { 232 /* 233 * In case when packet is ICMPv6 message from an intermediate 234 * router, the source address of message will not match the 235 * addresses from configured prefixes. 236 */ 237 if (args->f_id.proto != IPPROTO_ICMPV6) 238 return (0); 239 240 ret = nat64clat_handle_icmp6(chain, cfg, args->m); 241 } 242 243 if (ret == NAT64SKIP) 244 return (0); 245 246 *done = 1; /* terminate the search */ 247 if (ret == NAT64MFREE) 248 m_freem(args->m); 249 250 args->m = NULL; 251 return (IP_FW_NAT64); 252} 253